2d65edba1c5b8dd019ed516e5f7671dd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2d65edba1c5b8dd019ed516e5f7671dd_JaffaCakes118
Size

245KB
MD5

2d65edba1c5b8dd019ed516e5f7671dd
SHA1

1588e2844aa45d0d38af47e6ee6bd7c0cbe4ffc9
SHA256

abc15e8f596bde55a75a532b391f4062e393f7743dafa2b9bf0c86e19b36d84c
SHA512

ee49b2247a0ff63a13872d7e88b45f202cf9163aa801aa0aac6642e5841be4a25322d8ace405e86ead6aad66fc3bcd8c1246e2f70438678ac091285c98566a5b
SSDEEP

3072:HLY0/YlxvZIzfdyDDhvNSWuE4JZbX+8444A4svA4444A444A44bSEMlwLix4rqRf:rY0/yxBIB2DhvxuEixmx4cus+LK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d65edba1c5b8dd019ed516e5f7671dd_JaffaCakes118

Files

2d65edba1c5b8dd019ed516e5f7671dd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

934d1a498b34c53edb7df6bd408b95d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
LCMapStringW
LoadLibraryW
HeapSize
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
WriteConsoleW
SetFilePointer
lstrcpyA
AreFileApisANSI
LocalFree
GetCurrentThreadId
LoadLibraryA
GetPrivateProfileStringA
GetProcAddress
GetLastError
MultiByteToWideChar
CreateFileW
HeapCreate
Sleep
GetEnvironmentStrings
FormatMessageA
GetProcessHeap
GetTickCount
FreeEnvironmentStringsA
HeapFree
HeapAlloc
GetCPInfo
lstrlenA
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
SetStdHandle
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
EncodePointer
DecodePointer
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA

user32

SetWindowTextA
SendMessageA
GetSystemMetrics
ReleaseCapture
MapWindowPoints
AdjustWindowRect
MonitorFromRect
PostMessageA
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
DefWindowProcA
GetDlgItem
BeginPaint
GetUserObjectInformationA
ReleaseDC
GetWindowLongA
SetCursorPos
InvalidateRect
MessageBoxA
SetWindowLongA
SetRect
GetDC
WinHelpA
DrawTextExA
EndPaint
ClientToScreen
DestroyWindow
SetFocus
GetWindowRect
PostQuitMessage
GetWindowDC
GetThreadDesktop
SetCapture
KillTimer
SetForegroundWindow
WindowFromPoint
GetClientRect
PtInRect

gdi32

GetTextExtentPoint32A
SetWindowExtEx
SetTextColor
DeleteDC
SelectObject
CreateCompatibleDC
RealizePalette
SelectPalette
BitBlt

advapi32

LogonUserA
ControlService
BuildExplicitAccessWithNameA
IsValidSid
OpenSCManagerA
QueryServiceStatusEx
AllocateAndInitializeSid
QueryServiceObjectSecurity
SetSecurityDescriptorDacl
ChangeServiceConfigA
InitializeSecurityDescriptor
RegQueryValueExA
GetSidSubAuthorityCount
SetServiceObjectSecurity
SetEntriesInAclA
CloseServiceHandle
OpenServiceA
GetSidIdentifierAuthority
CreateProcessAsUserA
GetSecurityDescriptorDacl

ole32

CoUninitialize
OleInitialize
CoCreateInstance
CoInitialize

wininet

HttpSendRequestA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA

winmm

mmioAscend

wintrust

CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash

rpcrt4

UuidHash
RpcStringBindingComposeW

dbghelp

SymGetOptions

winhttp

WinHttpOpen
WinHttpOpenRequest

urlmon

ObtainUserAgentString

snmpapi

SnmpUtilMemAlloc

ntdsapi

DsCrackUnquotedMangledRdnA

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

934d1a498b34c53edb7df6bd408b95d9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

wininet

winmm

wintrust

rpcrt4

dbghelp

winhttp

urlmon

snmpapi

ntdsapi

Sections

.text Size: 78KB - Virtual size: 77KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 143KB - Virtual size: 142KB

.text
Size: 78KB - Virtual size: 77KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 143KB - Virtual size: 142KB